Single sign-on (SSO) allows people to log-in to Talos Perform using an account they're already using at work - which is great because they don't need to remember a new password.
Note: You will need Configurator access to enable SSO.
If your organisation uses an identity provider such as Microsoft Entra ID, ADFS, Okta or OneLogin, then you can set up SSO with Talos Perform. Talos Perform can also support any SAML2.0-enabled Identity Provider.
If you use Microsoft Entra ID, follow the Microsoft tutorial here.
If you use Google SSO, then please follow the instructions in this help page.
If you're using an alternative provider, then you'll need to configure SAML SSO yourself.
How to configure SAML SSO
In your identity provider (e.g. OneLogin) create a new application profile for Talos Perform. You may need to refer to their instructions for this. When setting up the application you will need to input some of the URLs that you saw under the "Single sign-on with SAML" setting in Talos Perform.
While you're creating the application in your identity provider, you'll be given some details you need to input into Talos Perform. These include: X509 certificate in Base64 format, Identity Provider Single Sign-On URL and Identity Provider Issuer URL.
By default, Talos Perform will allow SSO and your existing password-login access simultaneously.
To test it, log out of Talos Perform and then try clicking on the Talos Perform application button in your identity provider. You should be logged in to Talos Perform immediately.
Once you've got SSO working, go to Configuration > Security > Main and change "Login options - SSO and password" to "Login with SAML SSO only, emails to users to contain the SSO link".
All emails to users will now contain your unique SAML SSO login URL which will allow them to bypass the standard login page and go straight into their account. You can also share this link internally, it's the one in Configuration > Security > Single sign-on > Single sign-on with SAML > Service-initiated login URL.
Troubleshooting
Here are things to check if SSO is not working:
If you find some users cannot log in using SSO but some can, then it's unlikely to be a problem with Talos Perform or the way you've configured your connection with Talos Perform. Instead, ask them to try a different browser, and check that they have been configured in your identity provider with the same privileges to access the application profile as you.
Make sure the NameID being passed to Talos Perform is set to be the user's email address
Ensure the email address in the identity provider matches the email in Talos Perform exactly
Ensure you've selected AES256-bit encryption in your identity provider application
Other ways to login
You can also login via Microsoft or Google using your login details for these. You don't need to configure anything, they will automatically be available if you have Microsoft or Google accounts.
